mirror of
https://github.com/PHPOffice/PhpSpreadsheet.git
synced 2026-11-10 03:46:21 +00:00
oleibman
b03f7f3371
Responding to some suggestions in issue #4923. In particular, I am adding a SECURITY.md file to formally document what researchers are already doing to open security advisories with us. I am also adding a dev requirement for `cyclonedx/cyclonedx-php-composer` to permit the creation of a Software Bill of Materials (sbom.xml) in an "accepted interchange format". It is suggested in the discussion that this could be part of the CI. I am nervous about that, and I don't think it's much of a burden to run the procedure manually immediately before a new release; I have added the new procedure to `composer.json` and documented it in `CONTRIBUTING.md`.
1.2 KiB
1.2 KiB
Security Policy
Reporting a Vulnerability
If you discover a security vulnerability within this project, please report it via Private Vulnerability Reporting.
Please do not report security vulnerabilities through public GitHub issues.
What to Include
- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting).
- Full paths of source file(s) related to the manifestation of the issue.
- The location of the affected source code within those paths.
- Proof of concept (step-by-step instructions to reproduce the issue).
- Suggested remediation.
Supported Versions
| Version | Supported |
|---|---|
| >= 5.10.0 | ✅ |
| >= 4.0.0, < 5.10.0 | ❌ |
| >= 3.10.8, < 4.0.0 | ✅ |
| >= 3.0.0, < 3.10.8 | ❌ |
| >= 2.4.8, < 3.0.0 | ✅ |
| >= 2.2.0, < 2.4.8 | ❌ |
| >= 2.1.19, < 2.2.0 | ✅ |
| >= 2.0.0, < 2.1.19 | ❌ |
| >= 1.30.6, < 2.0.0 | ✅ |
| < 1.30.6 | ❌ |
Disclosure Policy
We follow a coordinated vulnerability disclosure approach. We ask that you give us reasonable time to address the issue before making any public disclosures.